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CLAIMS 

What is claimed is: 

1 . An apparatus for identifying a merged lookup result, the apparatus comprising: 

a mechanism for generating a lookup value; 
5 one or more associative memories for generating a plurality of associative 

memory results based on the lookup value, the plurality of associative memory results 
including at least one result from each of said one or more associative memories; 

a one or more adjunct memories, coupled to said one or more associative 
memories, for performing lookup operations on said plurality of associative memory 
10 results to generate a plurality of lookup results; and 

a combiner, coupled to said one or more adjunct memories, for merging the 
plurality of lookup results to generate the merged lookup result. 

2. The apparatus of claim 1, wherein the plurality of lookup results are each 
associated with precedence indications stored in said one or more adjunct memories, and 
1 5 wherein said combiner selects one of the plurality of lookup results as the merged 

result based on said precedence values of the plurality of lookup results. 

3. The apparatus of claim 1 , wherein each of the plurality of lookup results 
correspond to a different feature as defined in an access control list. 
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4. A method for identifying a merged lookup result, the method comprising: 
identifying an access control list including a plurality of access control list entries; 
identifying a first set of access control list entries corresponding to a first feature 

of said plurality of access control list entries; 
5 programming a first associative memory bank and a first adjunct memory with 

first associative memory entries corresponding to the first set of access control list entries 

identifying a second set of access control list entries corresponding to a first 
feature of said plurality of access control list entries; and 

programming a second associative memory bank and a second adjunct memory 
10 with second associative memory entries corresponding to the second set of access control 
list entries; 

wherein said first associative memory entries have a higher lookup precedence 
than said second associative memory entries. 

5. The method of claim 4, comprising: 
1 5 identifying a lookup value; 

performing lookup operations in the first associative memory bank and the first 
adjunct memory to generate a first second lookup result; 

performing lookup operations in the second associative memory bank and the 
second adjunct memory to generate a second lookup result; and 
20 merging the first and the second lookup results to identify a merged result. 

6. The method of claim 5, wherein said lookup operations in the first and the 
second associative memory banks are performed substantially simultaneously. 

1, The method of claim 5, wherein if the first associate memory result corresponds 
25 to a deny operation, the merged result corresponds to a drop packet operation. 
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8. The method of claim 5, wherein if the first associate memory result corresponds 
to a permit operation and the second associative memory result corresponds to a permit 
operation, the merged result corresponds to a permit operation. 

9. The method of claim 5, wherein if the first associate memory result corresponds 
5 to a permit operation and the second associative memory result corresponds to a deny 

operation, the merged result corresponds to a drop packet operation. 

10. A method for identifying a merged lookup result, the method comprising: 
identifying a packet; 

identify a first lookup value; 
10 performing substantially simultaneous lookup operations in a plurality of 

associative memories and adjunct memories to generate a plurality of first lookup results; 
merge the plurality of first lookup results to identify a merged first result; 
identify a second lookup value; 

performing substantially simultaneous lookup operations in the plurality of 
1 5 associative memories and adjunct memories to generate a plurality of second lookup 
results; and 

merge the plurality of second lookup results and the merged first result to identify 
a merged second result. 

11. The method of claim 10, each of the plurality of first lookup results 
20 correspond to a different feature of a first type as defined in an access control list. 

12. The method of claim 11, each of the plurality of second lookup results 
correspond to a different feature of a second type as defined in the access control list. 

13. The method of claim 12, wherein the first type includes a security operation 
and the second type includes a quality of service operation. 



43 



04546 



14. The method of claim 10, wherein the first lookup value includes at least one 
autonomous system number, said at least one autonomous system number identify a set of 
communication devices under a single administrative authority 

15. A computer-readable medium containing computer-executable instructions for 
5 performing steps for identifying a merged lookup result, said steps comprising: 

identifying an access control list including a plurality of access control list entries; 
identifying a first set of access control list entries corresponding to a first feature 
of said plurality of access control list entries; 

programming a first associative memory bank and a first adjunct memory with 
10 first associative memory entries corresponding to the first set of access control list entries 
identifying a second set of access control list entries corresponding to a first 
feature of said plurality of access control list entries; and 

programming a second associative memory bank and a second adjunct memory 
with second associative memory entries corresponding to the second set of access control 
15 list entries; 

wherein said first associative memory entries have a higher lookup precedence 
than said second associative memory entries. 

16. The computer-readable medium of claim 15, wherein said steps comprise: 
identifying a lookup value; 

20 performing lookup operations in the first associative memory bank and the first 

adjunct memory to generate a first second lookup result; 

performing lookup operations in the second associative memory bank and the 
second adjunct memory to generate a second lookup result; and 

merging the first and the second lookup results to identify a merged result. 
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17. The computer-readable medium of claim 16, wherein if the first associate 
memory result corresponds to a deny operation, the merged result corresponds to a drop 
packet operation. 

18. The computer-readable medium of claim 16, wherein if the first associate 
5 memory result corresponds to a permit operation and the second associative memory 

result corresponds to a permit operation, the merged result corresponds to a permit 
operation. 

19. The computer-readable medium of claim 16, wherein if the first associate 
memory result corresponds to a permit operation and the second associative memory 

10 result corresponds to a deny operation, the merged result corresponds to a drop packet 
operation. 
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20. An apparatus for identifying a merged lookup result, the apparatus 
comprising: 

means for identifying an access control list including a plurality of access control 
identifying an access control list including a plurality of access control list entries; 
5 means for identifying a first set of access control list entries corresponding to a 

first feature of said plurality of access control list entries; 

means for programming a first associative memory bank and a first adjunct 
memory with first associative memory entries corresponding to the first set of access 
control list entries 

10 means for identifying a second set of access control list entries corresponding to a 

first feature of said plurality of access control list entries; and 

means for programming a second associative memory bank, and a second adjunct 

memory with second associative memory entries corresponding to the second set of 

access control list entries; 
15 wherein said first associative memory entries have a higher lookup precedence 

than said second associative memory entries. 

21. The apparatus of claim 20, comprising: 
means for identifying a lookup value; 

means for performing lookup operations in the first associative memory bank and 
20 the first adjunct memory to generate a first second lookup result; 

means for performing lookup operations in the second associative memory bank 
and the second adjunct memory to generate a second lookup result; and 

means for merging the first and the second lookup results to identify a merged 

result. 
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22. An apparatus for identifying a merged lookup result, the apparatus 
comprising: 

means for identifying a packet; 

means for identify a first lookup value; 
5 means for performing substantially simultaneous lookup operations in a plurality 

of associative memories and adjunct memories to generate a plurality of first lookup 
results; 

means for merge the plurality of first lookup results to identify a merged first 

result; 

10 means for identify a second lookup value; 

means for performing substantially simultaneous lookup operations in the 
plurality of associative memories and adjunct memories to generate a plurality of second 
lookup results; and 

means for merge the plurality of second lookup results and the merged first result 
15 to identify a merged second result. 

23. The apparatus of claim 22, wherein: 

each of the plurality of first lookup results correspond to a different feature of a 
first type as defined in an access control list; and 

each of the plurality of second lookup results correspond to a different feature of a 
20 second type as defined in the access control list. 
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